New Proof Methods for Attribute-Based Encryption: Achieving Full - - PowerPoint PPT Presentation
New Proof Methods for Attribute-Based Encryption: Achieving Full Security through Selective Techniques Allison Lewko Brent Waters Roots of Attribute-Based Encryption Moving beyond Public Key Encryption: CEO Manager 1 Manager 2 Bob
New Proof Methods for Attribute-Based Encryption: Achieving Full Security through Selective Techniques
Allison Lewko Brent Waters
Roots of Attribute-Based Encryption
Moving beyond Public Key Encryption: Identity-based Encryption [S84,BF01,C01] Hierarchical Identity-based Encryption [HL02,GS02] Attribute-based Encryption [SW05]
Alice
“Bob” “Bob”
Bob
CEO Manager 1 Manager 2 employee employee Encrypt to Individual + superiors Encrypt to “users with hats”
Two Kinds of ABE
Ciphertext Policy ABE: Key Policy ABE:
(A Ç B) Æ C (A Ç B) Æ C {A, C} {A, C}
Security Goal for ABE
Challenger Attacker
Public Params
MSK
S1 S1 S2 S2
Si : set of attributes
M0, M1, Policy Enc(Mb, PP, policy)
Repeat Repeat
Proof Challenges
Hard problem ABE attacker Simulator Hard problem ABE breaks ABE Challenge: simulator must:
Partitioning Proofs
Previous approach – Partitioning [BF01, BB04, W05, GPSW06] Key Space
Can’t Make Keys Simulator Can Make
We Need:
Key Request Key Request Challenge Key Request Abort Challenge Abort
Problem: Why Should Attacker Respect the Partition?
Two Approaches:
(weaker) selective security
HA!
Selectively Secure ABE [GPSW06, W11]
Selectively Secure KP-ABE [GPSW06]: Simulator Attribute set S
Satisfied by S Formulas NOT satisfied by S
Public Parameters
Selectively Secure ABE [GPSW06, W11]
Selectively Secure CP-ABE [W11]: Simulator Access Policy P
Satisfying P Sets NOT satisfying P
Public Parameters
Dual System Encryption [W09]
Normal Semi-Functional Normal
Used in real system
A Dual System Encryption Proof
Mb
Not Compatible!
Real Security Game: Hybrid Argument:
Incompatiblity of key/CT High probability decryption failure Decryption failure Message independent CT
Regardless of Compability! Hardest step previously done With info-theoretic argument
Dual System Encryption Reimagined
Semi-functional Space Normal Space Public Parameters
Decompose: Normal Component Semi-functional component Separated from PP
Parameters in S.F. Space “delayed” until first semi-functional
The Security Game in S.F. Space
Attacker Challenger Public Params Si : sets of attributes S1
Repeat
M0, M1, policy Enc(Mb, PP, policy)
Repeat
Si
PP in S.F. Space
Dividing the Proof: Two Cases
Thought experiment: consider attacker requesting one key (generalize to many keys via hybrid argument) Case 1: CT request comes before key attacker challenger Access Policy P
Satisfying P Sets NOT satisfying P
Like selective CP-ABE!
Semi-functional space
Dividing the Proof: Two Cases
Thought experiment: consider attacker requesting one key (generalize to many keys via hybrid argument) Case 2: key request comes before CT attacker challenger Set S
Satisfied by S Formulas NOT satisfied by S
Like selective KP-ABE!
Semi-functional space
Proof Schematic
CT Key 1 Key 2 Key 3 Key 4 Key 5 Key 6 Timeline of Game ->
Expand into S.F. Space
PP
Expand into S.F. Space Partitioning proof Partitioning proof
Erase Message
Summary of Techniques
Selective security proof for CP-ABE Selective security proof for KP-ABE Dual System Encryption
Fully Secure ABE
Open Problems
assumption
Thanks for your attention!
Questions?